DEV: If only one auth provider is enabled allow GET request

In this case, the auth provider is acting as a SSO provider, and can be trusted to maintain its own CSRF protections.

spec/requests/omniauth_callbacks_controller_spec.rb

@@ -146,6 +146,14 @@ RSpec.describe Users::OmniauthCallbacksController do
           post "/auth/google_oauth2", params: { authenticity_token: token }
           expect(response.status).to eq(302)
         end
+
+        it "should not be CSRF protected if it is the only auth method" do
+          get "/auth/google_oauth2"
+          expect(response.status).to eq(200)
+          SiteSetting.enable_local_logins = false
+          get "/auth/google_oauth2"
+          expect(response.status).to eq(302)
+        end
       end
     end